We also use a large perturbation budget for the comparison experiments to show the worst-case performance of the defense methods.
For defense models realized using Pytorch, we use the implementations of FGSM, FGM, BIM, C&W, and DeepFool from the foolbox library [1]}.
For those realized with TensorFlow, e.g., MagNet, we resort to cleverhans [2]} to implemented the attacks. Table REF  summarizes the attacks we employed.
